Todo #9868
closed
Add clientAuth EKU to Server type certificates
100%
Description
Some cases may require a server certificate to be used to authenticate a server (to client) and authenticate as a client (to another server). Currently, server certificates only include the serverAuth EKU, but both may be present.
Additionally, the ISRG-CPS-v2.6 standard followed by Let's Encrypt contains both for end entity certificates.
Looking at some other standards like RFC 5280 (EKU), RFC 5216/RFC 5281 (EAP-[T]TLS) they all mention things in a permissive way, meaning that the presence of specific values enables uses. I don't see anything that would exclude or fail based on the presence of an EKU.
Updated by Jim Pingle over 4 years ago
- Status changed from New to Feedback
- % Done changed from 0 to 100
Applied in changeset 46869dd2b5ebf32e8297d65f98444fb38d314336.
Updated by Viktor Gurov over 4 years ago
Jim Pingle wrote:
Applied in changeset 46869dd2b5ebf32e8297d65f98444fb38d314336.
Tested on 2.5.0.a.20191109.1723
Resolved -
Serial: 11
Signature Digest: RSA-SHA256
SAN: DNS:servertest, IP Address:192.168.1.1
KU: Digital Signature, Key Encipherment
EKU: TLS Web Server Authentication, TLS Web Client Authentication, IP Security IKE Intermediate
Key Type: RSA
Key Size: 2048
DN: /CN=servertest
...
Updated by Jim Pingle over 4 years ago
- Target version changed from 2.5.0 to 2.4.5
Updated by Jim Pingle over 4 years ago
- Status changed from Resolved to Feedback
Needs checked and/or tested again on 2.4.5 snapshots
Updated by Viktor Gurov over 4 years ago
Jim Pingle wrote:
Needs checked and/or tested again on 2.4.5 snapshots
tested on 2.4.5.a.20191205.1442_3:
...
EKU: TLS Web Server Authentication, TLS Web Client Authentication, IP Security IKE Intermediate
ok, Resolved